Prior Consent: Scope, Specificity and Withdrawal

In short, prior consent: scope, specificity and withdrawal turns on one question: which education file is involved, who holds it, and what purpose justifies the next step with it. Get those three answers right and most of the rest of the decision follows; miss any one of them and the requirement applied shall be the wrong requirement for the facts in front of you.

A disclosure log is not bureaucracy: it is the file that lets a student, an auditor or a regulator reconstruct what happened.

Yearly notifications are not a formality: they are the moment students learn what directory information means and how to opt out.

Marketing uses of student information need permission analysis even when the marketing feels ordinary or beneficial.

Support staff access to live files is a sharing in substance, even when the vendor describes it as maintenance.

Disciplinary releases to victims and others have specific limits, and the outcome that may be disclosed depends on the offence and the receiver.

Medical treatment files held by a campus clinic have their own treatment exemption, and the exemption ends when the record is used for another purpose.

Fingerprint and palm platforms for building access produce a biometric file for every student who enrols in them, and an alternative must exist for students who decline.

Wi-Fi tracking may reconstruct a student's movements across campus, and that capability ought to be governed before it is used, not after it is discovered.

Emergency releases need a real emergency and a judgment that the disclosure is necessary to safeguard health or safety, documented at the time.

Assistive technology can collect usage information that reveals disability, and vendors of such tools ought to be reviewed with that sensitivity in mind.

Put vendor terms in the contract, not in a sales deck, and check that the contract names the data, limits its use and requires removal on exit.

Assess AI tools with the same gate, plus a particular review of training information use, prompt retention and output handling.

State the objective in a sentence a student could understand, and if the sentence can not be documented plainly, the objective is probably too broad.

Build opt-out into data feeds, so that an opt-out exercised in one platform propagates to every platform that publishes the data.

Review a determination following it is made: was the data used for the stated objective, does the recipient still need it, has storage expired?

Review access when roles alter, and treat a role alter without an access review as an open incident, not an administrative delay.

Limit financial aid disclosures to what the aid determination requires, and do not include unrelated record details since they happen to be in the same file.

Audit vendor compliance, and do not accept a vendor's self-assessment as a substitute for evidence where the data is personal.

Consider a learning app for younger students that tracks behaviour across sessions and shares aggregates with a third party, without a privacy review.

Consider a site card platform whose transaction logs were kept indefinitely, and a review that sets a retention period tied to the purposes of those logs.

In that illustration a review finds the retention unjustified, the birth dates are deleted, and the screening is redesigned to collect the minimum required.

Consider a survey of younger users on a learning platform that collects birth dates for age screening and then retains them indefinitely.

In that illustration the older logs are deleted, the new period is published, and future logs expire automatically.

Disclosing on the strength of a letter alone, without a court order or subpoena procedure, is an error that can be avoided by a single phone call to the confidentiality officer.

Collecting biometric data without a non-biometric alternative is an error, because some students can not or will not enroll, and they ought not to be disadvantaged.

Screening younger users by collecting more data than the screening requires is a mistake, because the safeguarding then becomes the problem.

Documenting an emergency disclosure following the fact, from memory, is an error, because later reconstruction rarely convinces a reviewer.

Writing a policy that staff cannot state without opening the document is a mistake, since the policy shall not be followed under time pressure.